# Nix itself, boot, locale, network and the user account.
{
  inputs,
  pkgs,
  ...
}:
{
  nixpkgs = {
    config.allowUnfree = true;
    overlays = [ (import ../../pkgs inputs) ];
  };

  nix = {
    settings = {
      experimental-features = [
        "nix-command"
        "flakes"
      ];
      # Lets you (as a wheel member, who can sudo anyway) use the binary caches
      # flakes ask for, such as the CachyOS kernel's.
      trusted-users = [
        "root"
        "@wheel"
      ];
      auto-optimise-store = true;
    };
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 14d";
    };
    # `nix shell nixpkgs#foo` uses the same nixpkgs as the system.
    registry.nixpkgs.flake = inputs.nixpkgs;
    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
  };

  boot = {
    loader = {
      systemd-boot = {
        enable = true;
        configurationLimit = 10;
      };
      efi.canTouchEfiVariables = true;
      timeout = 3;
    };
    initrd.systemd.enable = true;
    plymouth.enable = true;
    kernelParams = [
      "quiet"
      "splash"
    ];
    tmp.useTmpfs = true;
  };

  zramSwap = {
    enable = true;
    algorithm = "zstd";
    memoryPercent = 100;
    priority = 100;
  };

  time.timeZone = "Europe/Oslo";
  i18n.defaultLocale = "en_US.UTF-8";
  console.keyMap = "no";

  networking = {
    networkmanager.enable = true;
    # CachyOS: /etc/sysctl.d/99-disable-ipv6.conf
    enableIPv6 = false;
    # ufw on CachyOS: drop incoming except SSH.
    firewall = {
      enable = true;
      allowedTCPPorts = [ 22 ];
    };
  };
  services.resolved.enable = true;

  services.avahi = {
    enable = true;
    nssmdns4 = true;
    # ufw kept port 5353 closed on CachyOS too.
    openFirewall = false;
  };

  services.openssh.enable = true;
  services.fstrim.enable = true;

  users.users.vizie = {
    isNormalUser = true;
    # The same uid as on CachyOS, so the home folder restored from the backup
    # (MIGRATION.md) belongs to you.
    uid = 1000;
    description = "Gustaf Granström";
    shell = pkgs.zsh;
    extraGroups = [
      "wheel"
      "networkmanager"
      "video"
      "audio"
      "input"
      "lp"
      # Claude Desktop's Cowork VM needs /dev/kvm and /dev/vhost-vsock.
      "kvm"
    ];
  };
  programs.zsh.enable = true;

  environment.systemPackages = with pkgs; [
    git
    gh
    wget
    curl
    rsync
    unzip
    unrar
    pv
    less
    file
    which
    vim
    nano
    micro
    neovim
    tmux
    btop
    duf
    glances
    fastfetch
    ripgrep
    fd
    jq
    yq-go
    usbutils
    pciutils
    lsof
    dmidecode
    hwinfo
    smartmontools
    hdparm
    ethtool
    btrfs-progs
    compsize
    exfatprogs
    dosfstools
    ntfs3g
    efibootmgr
    man-pages
  ];
}